Tips & Tricks
Short, practical notes from the field: tooling, tradecraft, and shortcuts.
Active Directory
16
Windows and Active Directory tradecraft.
AI & LLM Security
19
Auth & Tokens
12
Cloud & Containers
13
Cloud and identity tips.
Exploitation
2
Turning bugs into working access.
Linux & Privesc
8
Linux tips and privilege escalation.
Recon & OSINT
11
Finding attack surface and mapping targets.
Red Team & Evasion
9
Source Code Review
31
Web & API
22
Web application testing tips.
Windows Post-Exploitation
8
All tips
- 2FA bypass through flow and response manipulation Test skipping the OTP step, replaying a success response, and whether backup codes or remember-me tokens are weaker.
- SAML NameID comment injection A comment inside the signed NameID can make the app read a different identity than the one the signature covered.
- SAML signature wrapping (XSW) Move the signed assertion aside and inject an unsigned one so the verifier checks the original but consumes yours.
- PKCE downgrade on public OAuth clients If the token endpoint still accepts a plain or absent code_verifier, an intercepted code is redeemable without the secret.
- OAuth redirect_uri and response_type juggling Loose redirect matching or switching to the token response type can leak the authorization code to an attacker URL.
- JWT kid injection to path traversal or SQL The kid header often indexes a key by file path or database row, so it inherits traversal and SQL injection.
- JWT header injection via jku and x5u If the verifier fetches the key from a URL in the token header, point it at your own JWKS and sign with your matching key.
- JWT algorithm confusion, RS256 to HS256 A generic verify that does not pin the algorithm lets you sign HS256 tokens using the RSA public key as the HMAC secret.
- Password spraying that respects lockout policy Read the lockout threshold and window first, then spray one password per window across all users to stay under it.
- Relay NTLM to LDAP to configure RBCD When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.